Snapshot 220015
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Sitecore Sitecore is a global leader in AI-enabled digital experience software. Its next-generation platform, SitecoreAI, helps brands plan, create, personalize, and deliver content across every channel — websites, apps, social, and beyond. By unifying content management, customer data, and personalization into one intelligent system, it makes marketing faster, smarter, and more connected. At its core are agentic tools and studios that let marketers and developers collaborate with AI responsibly and effectively. Trusted by thousands of global brands and supported by one of the world’s largest digital experience communities, Sitecore helps organizations design experiences for the world beyond the website, with the flexibility of customizable SaaS and the scale of a global ecosystem. trust@sitecore.com Privacy PolicyOpens in new tab Compliance SOC 2 Type II S SOC 1 Type II ISO/IEC 42001:2023 ISO 27001:2022 ISO 27017:2015 ISO 27018:2019 HIPAA I IRAP TISAX PCI DSS - SAQ D FAQ View all Updates View all Security Updates on Node.js Brotli Vulnerabilities including updates for .NET impact with Sitecore Products Published November 4, 2026 Last updated: 4 November 2026 Previously published as part of Sitecore Security Bulletins. If you have questions about Sitecore products, please contact the Sitecore Customer Support teamOpens in new tab Update 4 November 2026 Status: Under monitoring Sitecore continues to monitor the recently disclosed CVE-2026-111497Opens in new tab vulnerability in Node.js and .NET affecting Brotli decompression, sometimes referred to publicly as “Broccoli2Shell.” Based on our investigation to date, Sitecore has not identified any evidence of exploitation of this vulnerability, or any resulting compromise of customer data or disruption to Sitecore-hosted services. Our investigation is ongoing, and we will update this page as appropriate. As part of our standard vulnerability management practices, Sitecore applies relevant security updates across its systems in line with vendor and industry guidance. If you have questions about Sitecore products, please contact the Sitecore Customer Support teamOpens in new tab SitecoreAI Sitecore has enabled web application firewall (WAF) rules in blocking mode, to provide additional mitigation to known attack vectors for this vulnerability. SitecoreAI updated the Content SDK/JSS for Node.js on October 21, 2026. Customers using the Content SDK/JSS are advised to redeploy and update the Content SDK/JSS and StarterKit to the October 21 (or later) version which includes security updates to Node.js. Customers with a customer-controlled .NET or Node.js dependency are advised to apply updates following published guidance. SitecoreAI components, including Delivery Edge, alongside internal components are running on patched versions. Components including XMCloud Deploy, DAM have been updated and will be deployed by end of day Nov 4 (delayed due to production freezes). Content Hub Content Hub is protected by Sitecore’s web application firewall (WAF) including blocking mode rules to provide additional mitigation to known attack vectors for this vulnerability. SitecoreAI Content Hub images including all actively used containers have been updated following Microsoft guidanceOpens in new tab. The remaining Content Hub images with a .NET dependency are being updated following Microsoft guidanceOpens in new tab. Managed Cloud Managed Cloud customers using Azure Front Door Standard are advised to apply the custom rule set identified by Microsoft to block any request whose Content-Encoding header includes the br (Brotli) coding, or ensure they are running the latest Azure-managed Default Rule Set (DRS) 2.2. Customers should consider whether blocking Brotli-encoded requests may affect legitimate traffic to their applications and may wish to run the custom rule in log mode first to ensure there is no impact to traffic flow. Managed Cloud PaaS customers using Azure App service will have operating system maintenance, including regular security patching and updates delivered by Microsoft. Managed Cloud Containers customers will need to deploy a new image containing the necessary patches. Experience Edge Experience Edge applications have been updated; no additional customer action is required at this time. Update 27 October 2026 Status: Under monitoring SitecoreAI SitecoreAI customers are advised to redeploy and update the Content SDK/JSS and StarterKit to the October 21 (or later) version which includes security updates to Node.js. Sitecore has enabled web application firewall (WAF) rules in blocking mode, to provide additional mitigation to known attack vectors for this vulnerability. SitecoreAI underlying images with a .NET dependency have been updated following Microsoft guidanceOpens in new tab. Managed Cloud Managed Cloud customers using Azure Front Door Standard (as provided with Sitecore Managed Cloud) are advised to apply the custom ruleOpens in new tab set identified by Microsoft to block any request whose Content-Encoding header includes the br (Brotli) coding. Customers should consider whether blocking Brotli-encoded requests may affect legitimate traffic to their applications. Managed Cloud PaaS customers using Azure App service will have operating system maintenance, including regular security patching and updates delivered by Microsoft. Managed Cloud Containers customers will need to deploy a new image containing the necessary patches. Sitecore PDXP including XP, XM, XC While Sitecore XP, XM, XC have .NET runtime/framework as a prerequisite, it is not bundled inside the Sitecore application installation and is a customer responsibility to patch. XP, XM, XC customers are strongly advised to update their underlying .NET environments following Microsoft guidance. Sitecore’s retrieves the latest .NET runtime version during each monthly maintenance period and has not identified any incompatibility issues when using the most recent version. Sitecore continues to test and confirm susceptibility to vulnerabilities and will provide further updates if additional actions are required. Overall Customers are reminded that WAF protections provide an additional mitigation layer but do not replace patching, in particular for malicious upstream responses or traffic that does not pass through the WAF. Customers should consider whether blocking Brotli-encoded requests may affect legitimate traffic to their applications. As part of our standard vulnerability management practices, Sitecore applies relevant security updates across its systems in line with vendor and industry guidance. Where Sitecore determines that an event requires notification under a customer’s agreement or applicable law, Sitecore will notify affected customers directly in accordance with those terms. If you have questions about Sitecore products, please contact the Sitecore Customer Support teamOpens in new tab More info on the vulnerability Node.js does not decode Brotli data on its own. Exploitation requires an application or dependency to decompress attacker-controlled Brotli data, either through incoming HTTP requests, externally fetched responses, or other untrusted compressed content. Researchers have demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. Customers that deploy or operate components that use Node.js, Next.js or Brotli (directly or through dependencies), including customer-deployed front-end applications, are responsible for assessing and updating those components. We recommend remediating as soon as possible, in line with published guidance including Node.js Security Release informationOpens in new tab. Update: October 21, 2026 On October 21, 2026 updates for Node.js 26.x, 24.x, 22.x were released, including security updates to address public vulnerabilities including · Brotli decoder out-of-bounds write allowing RCE (CVE-2026-111497), · dns.resolve truncation via NUL characters (CVE-2026-105482), and · TLS hostname bypasses involving fullwidth digits (CVE-2026-105483) · TLS hostname bypasses involving loose IP resolution (CVE-2026-106069) These are found in dependent packages: · c-ares on 26.x, 24.x, 22.x · ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x · OpenSSL on 24.x, 22.x · SQLite on 22.x · Undici on 26.x, 24.x, 22.x SitecoreAI Customers who use Node.js are advised to update their usage of Node.js including within the SitecoreAI Starter Kit and Content SDK/JSS. Sitecore has released an update to the Content SDK/JSS to include the security updates to Node.js. Customers are advised to redeploy the latest version of the Starter Kit including Content SDK/JSS to ensure they have the latest version. Also published as: https://support.sitecore.com/kbOpens in new tabid=kb_article_view&sysparm_article=KB1010980 General Sitecore Statement on PHP Vulnerabilities Published October 21, 2026 Last updated: 23 October 2026 Status: Under monitoring Sitecore continues to monitor the impact of recently disclosed vulnerabilities in PHP. Based on our investigation to date, we have not identified any impact to Sitecore or Sitecore products and services. In our 21 October statement, we noted that some customers might be affected through use of Matomo, a PHP-based analytics tool. Based on our continued investigation, we no longer observe Matomo use in customer environments on the Sitecore platform. Customers that deploy or operate components that use PHP (directly or through dependencies) are responsible for assessing and updating those components, and we recommend remediating as soon as possible, in line with guidance from the PHP project. SitecoreAI environments continue to benefit from Web Application Firewall protections deployed through Sitecore’s Cloudflare instance since 21 October, 03:02 UTC. These protections reduce, but do not replace the need for, patching of affected PHP components. We continue to monitor this matter and will update this page if our assessment changes. 21 October 2026 Sitecore is aware of the recent disclosed vulnerabilities in PHP. Sitecore products, including SitecoreAI, do not rely on PHP to deliver the Sitecore service and are not impacted. Sitecore products, including SitecoreAI, are behind Cloudflare. Cloudflare has deployed protections which cover SitecoreAI. Our early investigation indicates that a limited number of customers may be impacted through the use of Matomo (an analytics tool) or direct use of PHP. Where customer environments have a PHP dependency (direct or transitive), we recommend upgrading to a patched release as soon as possible, in line with guidance from the PHP project. SitecoreAI environments are protected by Sitecore’s Cloudflare instance and were protected starting 21 October, 03:02 UTC. We continue to monitor this matter and will update this page if our assessment changes. https://blog.cloudflare.com/php-vulnerabilities-waf-protectionOpens in new tab Cloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundationOpens in new tab, OpenAIOpens in new tab and WizOpens in new tab among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell. If you have questions about Sitecore products, please contact the Sitecore Customer Support teamOpens in new tab General Sitecore releases latest SOC1, SOC2, HIPAA, ISO27001, ISO27017, ISO27018 AND NEW! ISO42001 reports and certifications Published July 17, 2026 We are pleased to announce the publication of our latest independent assurance reports and certifications, including SOC 1 Type II, SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, HIPAA, and CSA STAR. These third-party audits and certifications provide customers with independent validation that Sitecore maintains robust security, privacy, availability, and compliance controls across our products, services, and operations. They reflect our ongoing commitment to transparency, accountability, and the protection of customer data. We are also proud to announce our newly achieved ISO/IEC 42001 certification, the world's first international standard for Artificial Intelligence Management Systems (AIMS). As one of the early organizations to obtain this certification, Sitecore is helping establish the benchmark for responsible AI governance. ISO 42001 provides independent assurance that AI is managed through defined governance processes, risk management practices, oversight mechanisms, and controls designed to promote transparency, accountability, safety, and ethical use. For our customers, this certification offers increased confidence that AI capabilities are developed, deployed, and operated within a structured framework that prioritizes trust, responsible innovation, and regulatory readiness. As organizations increasingly adopt AI-powered solutions, ISO 42001 demonstrates Sitecore's commitment to ensuring that AI is governed with the same rigor, discipline, and independent oversight that customers have come to expect from our security and compliance programs. Incident InfoSec Communication – Vercel Security Incident – April 2026 Published April 20, 2026 Date: 20 April 2026 Sitecore is aware of the Vercel security incident.Opens in new tab While Sitecore.com does use Vercel as a hosting provider, we have received the following notification from Vercel: "At this time, we do not have reason to believe that your Vercel credentials or personal data have been compromised." We are taking the appropriate steps as recommended by Vercel and will continue to monitor our environment, take appropriate steps and provide updates as required. Customer Recommendations Vercel is directly notifying customers with impact and next steps; please confirm that you have up-to-date contact informationOpens in new tab with Vercel. Sitecore customers who use Vercel as a hosting provider should follow Vercel’s recommendationsOpens in new tab, including but not limited to rotation of environment variables. If you need assistance, please raise a ticket with our Customer Support team.Opens in new tab For information about managing a Vercel communication, please see Sitecore documentationOpens in new tab Resources View all Compliance Reports SOC 1 Type 2 SOC 2 Type 2 (SitecoreAI, Ordercloud, Search, CDP & Personalize) SOC 2 Type 2 (PDXP) SOC 2 Type 2 (Scrunch AI) View 2 more Certifications ISO 27001-27017-27018 Certificate ISO 42001 Certificate Sitecore TISAX Certificate SIG 2026 Sitecore SIG Lite - ENTERPRISE PCI AoC Sitecore PCI DSS - PlatformDXP_AoC Sitecore PCI DSS - Storefront by Four51_AoC Bridge Letter Sitecore SOC1 Type2, SOC 2 Type 2 + CSA STAR & HIPAA Bridge Letter Penetration Test Reports 2026 Penetration Test SitecoreAI 2026 Penetration Test Agentic Studio 2026 Penetration Test Scrunch AI Penetration Test 2025 Content Hub View 5 more DR Plan Extracts 2026 DR Plan Extract | Sitecore AI - Agentic Studio 2026 DR Plan Extract | Managed Cloud & Managed Cloud Container 2026 DR Plan Extract | SitecoreAI - Marketplace 2026 DR Plan Extract | SitecoreAI - Connect View 4 more DR Test Extracts 2026 DR Test Extract | Sitecore AI - Agentic Studio 2026 DR Test Extract | CDP & Personalization 2026 DR Test Extract | Managed Cloud & Managed Cloud Container 2026 DR Test Extract | SitecoreAI - Marketplace View 4 more Policy Summary (Extract) Information Security Policy Summary Access Control & Identification and Authentication Policy (Extract) Audit and Accountability Policy (Extract) Artificial Intelligence Policy (Extract) View 9 more